Insights that help security teams make better decisions.

The UK has no single binding PQC law like DORA's RTS. Instead, NCSC's 2028/2031/2035 migration timeline, the NIS Regulations, the Cyber Assessment Framework and sector rules combine into a de facto national deadline. Here is what actually applies.

ESC1 to ESC8 and golden certificate attacks show why ADCS configuration and a single CA private key remain structural PKI risks. How threshold MPC signing and real-time revocation change the model.

Enable post-quantum hybrid key exchange (ML-KEM) on F5 BIG-IP TMOS: cipher rules, client-ssl and server-ssl profiles, tmsh commands, testing and rollout strategy.

Production AI agents still share broad service accounts. Agentic cryptography gives each agent a revocable cryptographic identity, signed attestation per action, and no shared production credential.

Six practical criteria for choosing a Microsoft 365 Double Key Encryption (DKE) provider: rotation with continuity, Graph provisioning, multi-tenant B2B, ABAC, key custody and operations.

Generate a CycloneDX 1.7 Cryptography Bill of Materials (CBOM) with DuoKey Cockpit: filesystem, source-code and domain scans, the CBOM Explorer, and the agentic MCP path.

Enable hybrid post-quantum key exchange (ML-KEM, RFC 9370) on FortiGate IPsec VPNs: FortiOS CLI configuration, testing, and the agentic MCP path with DuoKey.

US federal PQC is no longer inventory-only. EO 14412 and OMB M-26-15 set HVA key establishment by 2030 and signatures by 2031. CNSA 2.0 covers national security systems. Here is who is in scope and what to do first.

The UAE has no single cryptography law either, but a more prescriptive, sector-specific landscape than the EU or UK: NESA's IAS, DESC's ISR v2, CBUAE's brand-new Regulation C 1/2026, the PDPL, and a real national post-quantum migration program launched in 2026.